Casco Expands Engineering and Sales to Scale Continuous AI Penetration Testing

Software testing has long relied on scheduled human assessments that take weeks to organize and execute. Casco is replacing that cadence with supervised, autonomous AI agents designed to hack web applications, APIs, cloud infrastructure, and AI systems continuously. Following its participation in Y Combinator's 2025 batch and backing from Rebel Fund, Pioneer Fund, and FundersClub, the startup is scaling out its team and commercial footprint.

In an interview with Standard Capital, the team detailed recent growth milestones, including signing a lease for a 7,000-square-foot office in San Francisco, standing up an engineering hub in Seattle, and working with clients such as Novvic and Spreedly. To keep pace with demand, the company has opened key technical and go-to-market roles across San Francisco and remote locations in the United States.

Autonomous Red Teaming Without False-Positive Noise

Traditional penetration testing requires organizations to book third-party human testers weeks ahead of time, paying five-figure sums for manual engagements that take two to four weeks to conclude. Because manual testers work under strict time limits, they often evaluate broad surfaces shallowly before chasing isolated hunches. As software release cycles accelerate and AI tooling multiplies the sheer volume of code deployments, manual pentesting once or twice a year leaves significant visibility gaps.

Casco approaches the problem by deploying autonomous software agents that run tests continuously. Unlike standard deterministic vulnerability scanners that overwhelm engineering teams with hundreds of false alerts, Casco focuses on verified exploit paths. In the interview on Standard Capital, co-founder and CEO Rene Brandel pointed out that automated security tools frequently produce "security slop where every single thing is like an alert," which exhausts security staff. Casco surfaces actionable findings and pairs automated testing with human attestation from certified security engineers.

This hybrid model provides customers with certified reports that meet procurement and compliance requirements. Casco is a CREST-certified penetration tester—becoming the first AI-native firm in the United States to hold the certification—and conducts PCI-compliant penetration tests for payment platforms like Spreedly. Onboarding takes roughly 10 minutes, requiring only host endpoints and test credentials before automated testing begins.

Founded by Former AWS Product and Security Leads

Casco was founded in 2025 by Rene Brandel and Ian Saultz. The two worked together for four years as product and engineering counterparts at Amazon Web Services. Brandel, who previously spent five years at Microsoft before his five years at AWS, created the Kiro IDE. Saultz spent a decade in software engineering, served as an AWS "security guardian" involved in internal application security reviews and external penetration testing, and was lead engineer on AWS AI kit.

During an appearance on On Security (a podcast powered by tact.), Saultz recounted how their initial focus was building development tooling and infrastructure guardrails for AI agents. When a pilot customer asked if they would perform a comprehensive security assessment across his full application instead, the founders delivered a manual assessment that the client immediately wanted to renew on a monthly basis. Realizing that continuous offensive testing addressed a much deeper business pain than guardrails, the founders pivoted within two weeks of their YC batch to build autonomous penetration testing systems.

During their YC batch, the founders famously stress-tested self-serve AI agents built by their batchmates, uncovering vulnerabilities in 13 out of 16 targets within 30-minute test windows to highlight security blind spots in emerging agent architectures.

Building Agentic Systems and Scaling Outbound Sales

Casco's technical architecture is predominantly TypeScript, utilizing agentic workflows and a custom computer-use stack. To grow its systems, the company is hiring engineers who can architect complex agent behaviors and productionize autonomous testing workflows.

Engineers looking to build core infrastructure can join as a remote Software Engineer ($200,000), building autonomous agent systems in TypeScript to conduct security assessments from conception to production without rigid specifications. For security specialists, the remote Offensive Security Engineer ($200,000) role conducts manual penetration tests across web apps, APIs, networks, and cloud environments, while evaluating and enhancing the findings generated by automated red-teaming systems and researching emerging LLM attack vectors.

In San Francisco, Casco is building out the user-facing platform and growth infrastructure. The Product Engineer ($200,000) works on-site to own the customer journey end to end—from contract signature to activation—designing interfaces across the Casco console, setup flows, email, and customer channels using TypeScript and React. To drive user acquisition, the on-site Growth Engineer ($180,000) designs automation systems using APIs, webhooks, and LLM agents while running technical experiments across platforms like Hacker News, Reddit, and LinkedIn.

On the commercial side, Casco is building an on-site enterprise pipeline targeting CISOs and application security leaders. The Technical Account Executive ($350,000) runs full-cycle sales from outreach and discovery to closing deals, representing the platform at industry security events. Supporting inbound and outbound outreach, the Sales Development Representative ($120,000) works alongside founders and sales reps to build the outbound playbook and qualify prospective accounts.

Current Job Openings at Casco

Casco provides competitive salaries across engineering, security, and go-to-market roles, maintaining an on-site hub in San Francisco alongside remote engineering options in the US.

See all open roles at Casco